openssh vulnerabilities

Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell
metacharacters in certain usernames. An attacker could possibly use this
issue to execute arbitrary commands when certain non-default
configurations were used, resulting in arbitrary code execution. This
issue only affected Ubuntu 14.04 LTS. (CVE-2026-35386)

Christos Papakonstantinou discovered that OpenSSH incorrectly handled
ECDSA algorithm restrictions. An attacker could possibly use this issue
to cause unintended ECDSA algorithms to be accepted, resulting in
security restrictions being bypassed. (CVE-2026-35387)

Vladimir Tokarev discovered that OpenSSH incorrectly handled certain
principal restrictions in authorized_keys files. An attacker could
possibly use this issue to bypass principal restrictions, resulting in
unauthorized access. This issue only affected Ubuntu 14.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-35414)

It was discovered that OpenSSH incorrectly handled downloaded file paths
when using sftp with an untrusted server. An attacker could possibly use
this issue to write downloaded files outside the intended location,
resulting in unauthorized file modification. (CVE-2026-59995)

It was discovered that OpenSSH incorrectly handled command-line
arguments in internal-sftp. An attacker could possibly use this issue to
cause certain security-related arguments to be ignored, resulting in
security restrictions being bypassed. (CVE-2026-59997)

It was discovered that OpenSSH incorrectly handled
GSSAPIStrictAcceptorCheck when used with Windows Active Directory. An
attacker could possibly use this issue to bypass GSSAPI security
restrictions, resulting in unauthorized access. (CVE-2026-59998)

It was discovered that OpenSSH incorrectly handled forwarding
restrictions when DisableForwarding and PermitTunnel were used together.
An attacker could possibly use this issue to create tunnels despite
forwarding being disabled, resulting in security restrictions being
bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2026-59999)

It was discovered that OpenSSH incorrectly handled authentication
attempt limits when using GSSAPI authentication. An attacker could
possibly use this issue to consume excessive system resources, resulting
in a denial of service. (CVE-2026-60000)

It was discovered that OpenSSH did not always enforce the minimum
authentication delay. An attacker could possibly use this issue to
perform authentication attempts more rapidly than intended, resulting in
weakened brute-force protections. This issue only affected Ubuntu 20.04
LTS. (CVE-2026-60001)

It was discovered that OpenSSH incorrectly handled certain concurrent
remote forwarding operations. An attacker could possibly use this issue
to trigger a use-after-free, resulting in a denial of service or
arbitrary code execution. (CVE-2026-73282)